The approaches described in this section could be pursued, but are not necessarily approaches that have been previously conceived or pursued. Therefore, unless otherwise indicated herein, the approaches described in this section are not prior art to the claims in this application and are not admitted to be prior art by inclusion in this section.
Senders of electronic mail messages that are unwanted or unsolicited (“spam”), or that contain viruses or other threats such as “phishing” attacks often use tactics to conceal the fact that the messages are unwanted or unsolicited, contain viruses or other threats. The message may have a subject line, sender name (“From:” value), and other elements that appear legitimate. In addition, the message may take steps to make it difficult for electronic systems to determine the intent of the message. However, the message may contain hyperlinks, uniform resource indicators (URIs), uniform resource locators (URLs), or other network resource identifiers that are associated with spam, viruses or other threats. When the user selects (“clicks on”) a hyperlink in such a message, the user's browser directs the user to a harmful or undesired page that delivers a virus, adware, or spyware, or attempts to induce the user into disclosing personal information or financial information, or leads to undesired content such as advertisements or pornography.
Other times, the URLs access executable code or scripts that report back to the spam engine the “successful” delivery of a spam message. Still other times, the URLs are intended for click-through marketing of whatever commercial products the spam relates to.
Consequently, when the message is received, based on typical analysis of the message content, threat detection systems and other analytical tools often cannot determine whether the message is spam or associated with threats.